Comprehensive guide for setting up the PayPal Model Context Protocol server
This guide provides detailed instructions for AI agents to assist with installing and configuring the PayPal MCP (Model Context Protocol) server. The MCP server enables secure integration between AI models and PayPal's payment services.
paypal-server/ ├── src/ │ └── index.ts # Main server implementation ├── .github/ │ └── workflows/ │ └── ci.yml # GitHub Actions workflow ├── package.json # Node.js dependencies and scripts ├── tsconfig.json # TypeScript configuration ├── README.md # General documentation ├── LICENSE # MIT license └── .gitignore # Git ignore rules
Initialize the project directory and install required dependencies.
# Create project directory mkdir paypal-server cd paypal-server # Initialize Node.js project npm init -y # Install dependencies npm install @modelcontextprotocol/sdk axios typescript @types/node
Ensure Node.js version 16 or higher is installed before proceeding.
Configure TypeScript for ES modules and strict type checking.
Guide users through setting up PayPal credentials:
Direct to developer.paypal.com
Guide through REST API setup
Help store Client ID/Secret
{
"mcpServers": {
"paypal": {
"command": "node",
"args": ["path/to/paypal-server/build/index.js"],
"env": {
"PAYPAL_CLIENT_ID": "your_client_id",
"PAYPAL_CLIENT_SECRET": "your_client_secret"
},
"disabled": false,
"autoApprove": []
}
}
}
Never commit these configuration files with real credentials. Use environment variables in production.
const result = await mcpClient.useTool('paypal', 'create_order', {
intent: 'CAPTURE',
purchase_units: [{
amount: {
currency_code: 'USD',
value: '1.00'
}
}]
});
// Test invalid credentials
const result = await mcpClient.useTool('paypal', 'create_order', {
// Invalid parameters to test error handling
});
Never store credentials in source code. Use environment variables for sensitive data.
Validate all input parameters before processing to prevent injection attacks.
Use HTTPS for all API calls to encrypt data in transit.
Never expose sensitive information in error messages.